from datetime import datetime
from typing import Dict, Any, Optional
import json
import hashlib

class AIAuditLogger:
    """Production-ready AI Audit Logger with tamper-proof logging"""
    
    def __init__(self, storage_backend: str = "s3"):
        self.storage = self._init_storage(storage_backend)
        self.log_buffer = []
    
    def log_decision(
        self,
        model_id: str,
        model_version: str,
        input_data: Dict[str, Any],
        output: Dict[str, Any],
        confidence: float,
        user_id: Optional[str] = None,
        session_id: Optional[str] = None,
        metadata: Optional[Dict[str, Any]] = None
    ) -> str:
        """
        Log an AI decision with full context.
        
        Returns audit_id for reference.
        """
        audit_record = {
            "timestamp": datetime.utcnow().isoformat(),
            "audit_id": self._generate_audit_id(),
            "model": {
                "id": model_id,
                "version": model_version,
                "type": self._get_model_type(model_id)
            },
            "input": {
                "data": input_data,
                "hash": self._hash_data(input_data)  # Privacy-preserving hash
            },
            "output": {
                "result": output,
                "confidence": confidence,
                "explanation": self._get_explanation(model_id, input_data, output)
            },
            "context": {
                "user_id": user_id,
                "session_id": session_id,
                "ip_address": self._get_client_ip(),
                "user_agent": self._get_user_agent()
            },
            "metadata": metadata or {},
            "compliance": {
                "gdpr_retention": True,
                "encrypted": True,
                "immutable": True
            }
        }
        
        # Add cryptographic signature for tamper-proofing
        audit_record["signature"] = self._sign_record(audit_record)
        
        # Store in immutable storage
        audit_id = audit_record["audit_id"]
        self._store_immutable(audit_id, audit_record)
        
        # Also buffer for batch processing
        self.log_buffer.append(audit_record)
        
        return audit_id
    
    def _generate_audit_id(self) -> str:
        """Generate unique, sortable audit ID"""
        timestamp = datetime.utcnow().strftime("%Y%m%d%H%M%S%f")
        random_suffix = hashlib.sha256(
            f"{timestamp}{id(self)}".encode()
        ).hexdigest()[:8]
        return f"AUDIT-{timestamp}-{random_suffix}"
    
    def _hash_data(self, data: Dict) -> str:
        """Create privacy-preserving hash of input data"""
        # Hash sensitive fields but preserve structure for debugging
        serialized = json.dumps(data, sort_keys=True)
        return hashlib.sha256(serialized.encode()).hexdigest()
    
    def _sign_record(self, record: Dict) -> str:
        """Cryptographically sign record to prevent tampering"""
        # Implementation using HMAC or digital signature
        record_str = json.dumps(record, sort_keys=True)
        return hashlib.hmac.new(
            self._get_signing_key(),
            record_str.encode(),
            hashlib.sha256
        ).hexdigest()
    
    def _store_immutable(self, audit_id: str, record: Dict):
        """Store in immutable storage (S3 with versioning, or blockchain)"""
        # Store in S3 with versioning enabled
        key = f"audit-logs/{audit_id}.json"
        self.storage.put_object(
            Key=key,
            Body=json.dumps(record),
            Metadata={
                "immutable": "true",
                "retention": "7-years"
            }
        )

# Usage
logger = AIAuditLogger()

# Log a decision
audit_id = logger.log_decision(
    model_id="sentiment-analysis-v2",
    model_version="2.3.1",
    input_data={"text": "This product is amazing!"},
    output={"sentiment": "positive", "score": 0.95},
    confidence=0.95,
    user_id="user-123",
    session_id="session-456",
    metadata={"feature_flags": ["new_model"], "region": "us-east-1"}
)

class ReproducibilityTracker:
    """Track all information needed to reproduce AI decisions"""
    
    def capture_training_context(self, model_id: str) -> Dict:
        """Capture training context for model"""
        return {
            "training_data": {
                "dataset_id": "dataset-2024-01",
                "dataset_version": "1.2.3",
                "data_hash": "abc123...",
                "splits": {"train": 0.8, "val": 0.1, "test": 0.1}
            },
            "hyperparameters": {
                "learning_rate": 0.001,
                "batch_size": 32,
                "epochs": 100,
                "optimizer": "Adam"
            },
            "code": {
                "git_commit": "abc123def456",
                "training_script": "train.py",
                "dependencies": self._capture_dependencies()
            },
            "environment": {
                "python_version": "3.11.0",
                "framework_version": "pytorch-2.1.0",
                "cuda_version": "12.1",
                "hardware": "A100-80GB"
            },
            "random_seeds": {
                "numpy": 42,
                "pytorch": 42,
                "cuda": 42
            }
        }
    
    def capture_inference_context(self, audit_id: str) -> Dict:
        """Capture context needed to reproduce inference"""
        return {
            "model_state": {
                "weights_hash": "model-weights-hash",
                "config_hash": "model-config-hash"
            },
            "preprocessing": {
                "tokenizer_version": "1.0.0",
                "preprocessing_steps": ["lowercase", "remove_punctuation"]
            },
            "runtime": {
                "framework_version": "pytorch-2.1.0",
                "inference_config": {"temperature": 0.7, "top_p": 0.9}
            }
        }

class RegulatoryReporter:
    """Generate regulatory reports from audit logs"""
    
    def generate_eu_ai_act_report(
        self,
        model_id: str,
        period_start: datetime,
        period_end: datetime
    ) -> Dict:
        """Generate EU AI Act compliance report"""
        audit_logs = self._query_audit_logs(
            model_id=model_id,
            start=period_start,
            end=period_end
        )
        
        return {
            "model_information": {
                "model_id": model_id,
                "purpose": "Sentiment Analysis",
                "risk_level": "High-Risk",
                "deployment_date": "2024-01-15"
            },
            "performance_metrics": {
                "total_decisions": len(audit_logs),
                "accuracy": self._calculate_accuracy(audit_logs),
                "error_rate": self._calculate_error_rate(audit_logs),
                "bias_metrics": self._calculate_bias_metrics(audit_logs)
            },
            "incidents": {
                "total_incidents": self._count_incidents(audit_logs),
                "incident_details": self._get_incident_details(audit_logs)
            },
            "human_oversight": {
                "human_review_count": self._count_human_reviews(audit_logs),
                "override_count": self._count_overrides(audit_logs)
            },
            "data_governance": {
                "training_data_source": "Internal + Licensed",
                "data_retention": "7 years",
                "data_subjects_rights": "Fully implemented"
            },
            "compliance_status": "Compliant",
            "report_generated_at": datetime.utcnow().isoformat()
        }
    
    def export_for_investigation(self, incident_id: str) -> Dict:
        """Export all relevant logs for incident investigation"""
        incident = self._get_incident(incident_id)
        
        return {
            "incident": incident,
            "related_decisions": self._get_related_decisions(incident),
            "model_versions": self._get_model_versions_in_period(incident),
            "training_data": self._get_training_data_info(incident),
            "system_logs": self._get_system_logs(incident),
            "user_actions": self._get_user_actions(incident)
        }

class IncidentInvestigator:
    """Framework for investigating AI incidents"""
    
    def investigate_incident(
        self,
        incident_id: str,
        severity: str = "high"
    ) -> Dict:
        """Conduct comprehensive incident investigation"""
        
        incident = self._get_incident(incident_id)
        
        investigation = {
            "incident_id": incident_id,
            "severity": severity,
            "timeline": self._build_timeline(incident),
            "root_cause_analysis": self._analyze_root_cause(incident),
            "affected_decisions": self._find_affected_decisions(incident),
            "model_analysis": self._analyze_model_behavior(incident),
            "data_analysis": self._analyze_data_quality(incident),
            "recommendations": []
        }
        
        # Automated root cause analysis
        if self._is_data_drift(incident):
            investigation["root_cause"] = "Data Drift"
            investigation["recommendations"].append("Retrain model with recent data")
        
        if self._is_model_degradation(incident):
            investigation["root_cause"] = "Model Degradation"
            investigation["recommendations"].append("Rollback to previous model version")
        
        if self._is_adversarial_attack(incident):
            investigation["root_cause"] = "Adversarial Input"
            investigation["recommendations"].append("Implement input validation")
        
        return investigation
    
    def _build_timeline(self, incident: Dict) -> List[Dict]:
        """Build chronological timeline of events"""
        events = []
        
        # Get all related audit logs
        audit_logs = self._get_related_audit_logs(incident)
        
        for log in sorted(audit_logs, key=lambda x: x["timestamp"]):
            events.append({
                "timestamp": log["timestamp"],
                "event": "AI Decision",
                "details": {
                    "input_hash": log["input"]["hash"],
                    "output": log["output"]["result"],
                    "confidence": log["output"]["confidence"]
                }
            })
        
        # Add model deployment events
        deployments = self._get_model_deployments(incident)
        for deployment in deployments:
            events.append({
                "timestamp": deployment["timestamp"],
                "event": "Model Deployment",
                "details": {
                    "version": deployment["version"],
                    "changes": deployment["changelog"]
                }
            })
        
        return sorted(events, key=lambda x: x["timestamp"])

# audit-config.yaml
audit:
  storage:
    backend: "s3"
    bucket: "ai-audit-logs"
    region: "us-east-1"
    encryption: "AES256"
    versioning: true
    immutability: true
  
  retention:
    default: "7-years"  # GDPR requirement
    high_risk: "10-years"
    incidents: "permanent"
  
  logging:
    level: "decision"  # decision, detailed, debug
    include_inputs: true
    include_outputs: true
    hash_sensitive_data: true
  
  compliance:
    gdpr_enabled: true
    eu_ai_act_enabled: true
    nist_ai_rmf_enabled: true
  
  performance:
    batch_size: 100
    flush_interval: "5s"
    async_logging: true

# ❌ Bad - Only log errors
if confidence < 0.5:
    logger.log_decision(...)

# ✅ Good - Log all decisions
audit_id = logger.log_decision(...)  # Always log

# ❌ Bad - Privacy risk
audit_record["input"] = user_data  # Contains PII

# ✅ Good - Privacy-preserving
audit_record["input"] = {
    "hash": hash_data(user_data),
    "metadata": extract_metadata(user_data)
}

# ❌ Bad - Can be tampered
audit_log["output"] = modified_output  # Security risk

# ✅ Good - Tamper-proof
audit_record["signature"] = sign_record(record)
store_immutable(audit_id, audit_record)

# ❌ Bad - Can't reproduce
audit_record = {"input": input, "output": output}

# ✅ Good - Fully reproducible
audit_record = {
    "model_version": "2.3.1",
    "training_data_hash": "...",
    "hyperparameters": {...},
    "random_seeds": {...}
}

Audit Logging Cost = Storage Cost + Processing Cost + Compliance Cost

Storage Cost = (Log Size × Logs/Day × Retention Days × Storage Price)
Processing Cost = (Query Volume × Query Cost)
Compliance Cost = (Reporting Time × Hourly Rate)

Example:
- 1M decisions/day × 1KB/log = 1GB/day
- 7-year retention = 2.5TB
- S3 storage: $0.023/GB = $57.50/month
- Query costs: ~$10/month
- Compliance reporting: 4 hours/month × $150/hour = $600/month
Total: ~$667/month for 1M decisions/day